Loading story…
Singapore’s Cyber Security Agency (CSA) reported that a Chinese cyber-espionage group tracked as UNC3886 compromised all four of the country’s major telecom providers—M1, SIMBA Telecom, Singtel, and StarHub—in an intrusion campaign that occurred the prior year and required roughly 11 months of joint investigation and remediation to evict the threat actor. CSA said investigators found evidence of theft of a small amount of technical data intended to enable follow-on access, but did not find evidence of customer data theft; reporting described the tradecraft as involving firewall zero-days and rootkits for persistence, consistent with UNC3886’s history of targeting enterprise and network infrastructure.
Separate reporting and commentary amplified the same telecom-breach narrative and placed it in the broader context of Chinese telco-focused espionage (often compared with Salt Typhoon) and UNC3886’s previously documented exploitation of perimeter and virtualization technologies (including Fortinet, Juniper, Ivanti SecureConnect, and VMware ESXi/vCenter). Other items in the provided material—such as a weekly roundup covering unrelated incidents (European Commission MDM exposure, Senegal ID disruption, and an Australian regulatory penalty), a law-enforcement story about IcedID developers, and a vendor podcast discussing critical-infrastructure threats—do not describe the Singapore telco intrusions and are not part of this specific event.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
On publication of the report, CSA publicly attributed the breaches of all four major Singapore telcos to UNC3886 and summarized the impact and response. The disclosure stated that no customer data theft had been identified.
CSA said it worked with industry for 11 months to investigate the telecom intrusions and remove the threat actors from affected environments. The agency assessed that only a small amount of technical data was taken and found no evidence of customer data theft.
Singapore's Cyber Security Agency said a Chinese cyber-espionage group tracked as UNC3886 compromised M1, SIMBA Telecom, Singtel, and StarHub during intrusions that occurred in 2025. The activity reportedly involved firewall zero-days and rootkits for persistence.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Singapore’s **Cyber Security Agency (CSA)** reported that the China-linked cyber espionage group **UNC3886** conducted a deliberate campaign targeting the country’s telecommunications sector, with **all four major telcos (Singtel, StarHub, M1, and SIMBA Telecom)** confirmed as targets and breached at least once. Authorities assessed the activity as focused on strategic access and intelligence collection rather than disruption; while attackers reached *some* network segments and had limited access to certain critical systems, Singapore reported **no service outages** and **no evidence of customer data theft**. CSA said UNC3886 used **sophisticated tooling**, including **weaponizing a zero-day exploit** to bypass a telco’s perimeter firewall and exfiltrate a small amount of technical data, and deploying **rootkits** to maintain persistence and evade detection. In response, Singapore launched **Operation Cyber Guardian**, with CSA and the **Infocomm Media Development Authority (IMDA)** coordinating a multi-agency investigation and containment effort to close access paths, expand monitoring, and reduce the risk of lateral movement into other critical sectors such as banking, transport, and healthcare; reporting also noted UNC3886’s broader tradecraft of targeting **edge devices** and **virtualization infrastructure** (e.g., VMware ESXi/vCenter) consistent with prior public research linking similar activity to the *Fire Ant* cluster.
Jun 29, 2026
Singapore’s Cyber Security Agency (**CSA**) said it worked with the Infocomm Media Development Authority (**IMDA**) and the country’s four major telecom providers—**M1, Simba Telecom, Singtel, and StarHub**—to remove a China-linked threat actor, **UNC3886**, after an extended intrusion effort against telecom networks and systems. The joint operation (“**Cyber Guardian**”) involved more than 100 incident responders and followed detection of a **zero-day exploit used to bypass a perimeter firewall**, along with **rootkits** used for persistence. Authorities reported **no evidence of customer data compromise** and **no disruption** to telecommunications services or Internet access, despite unauthorized access to some systems, including critical systems. Other items in the provided set are largely separate reporting (or opinion/roundups) on unrelated threats, vulnerabilities, and trends—e.g., a Kaspersky-described Android firmware supply-chain backdoor (**Keenadu**), a Notepad++ update-channel compromise attributed to **Lotus Blossom**, and broader industry reporting on RMM abuse, mobile spyware, Chrome zero-days, and ransomware activity. One additional source (Emsisoft) references the Singapore telecom incident only in passing as an example within a broader argument about the state of cybersecurity, and does not add new technical or impact details beyond the CSA-reported event.
Jun 29, 2026
Singapore launched its largest coordinated cyber defense and incident response effort after a sophisticated intrusion campaign targeted **all four major telecommunications operators**—**M1, SIMBA Telecom, Singtel, and StarHub**—according to the Cyber Security Agency of Singapore (CSA) and Minister Josephine Teo. Authorities described the activity as a deliberate, well-planned operation consistent with **cyber espionage**, prompting a whole-of-government response dubbed **Operation Cyber Guardian**. CSA said the attackers achieved **unauthorized access** to parts of telecom networks and, in at least one case, reached **limited portions of critical systems**, but reported **no service disruptions** and **no evidence** that customer data was accessed or exfiltrated. Singapore attributed the campaign to the China-linked threat actor **UNC3886**, noting the use of advanced tooling for stealth and persistence; officials also stated that at least one intrusion involved exploitation of a **previously unknown software vulnerability**, though detailed technical indicators were not publicly released.
Jun 29, 2026